wannacry | 554f9a45ff13004de1e16fab4be1e467374f940a963cc9ce65d2906f0c54857a

Resubmissions

18-05-2024 08:15

240518-j5t3lsbc4v 10

18-05-2024 07:00

240518-hstqmsgg9w 10

18-05-2024 06:28

240518-g8smvafg7y 10

Analysis

max time kernel
127s
max time network
128s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 08:15

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

53606881d4f8b4934c5ade1947e88bc9_JaffaCakes118.dll
Size

5.0MB
MD5

53606881d4f8b4934c5ade1947e88bc9
SHA1

5588e92d9be1ced63f3f9c6514a1a4a0ed90995e
SHA256

554f9a45ff13004de1e16fab4be1e467374f940a963cc9ce65d2906f0c54857a
SHA512

d431c39be859d8ce73c2e12a5cbf6d538540fdb9811b85cc65fde9bb2e3336ab3af5e80f6cf77c10a768e3f45cc8b699980f9a04bb909c3238be5d0ad853948e
SSDEEP

98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9yLGp2H:+DqPe1Cxcxk3ZAEUaYS4H

Score

10^/10

wannacry discovery ransomware worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Contacts a large (2637) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Executes dropped EXE 3 IoCs

Processes:

mssecsvc.exemssecsvc.exetasksche.exe

pid process

2448 mssecsvc.exe
2712 mssecsvc.exe
2756 tasksche.exe

pid	process
2448	mssecsvc.exe
2712	mssecsvc.exe
2756	tasksche.exe

Drops file in System32 directory 1 IoCs

Processes:

mssecsvc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	mssecsvc.exe

Drops file in Windows directory 2 IoCs

Processes:

rundll32.exemssecsvc.exe

description ioc process

File created C:\WINDOWS\mssecsvc.exe rundll32.exe
File created C:\WINDOWS\tasksche.exe mssecsvc.exe

description	ioc	process
File created	C:\WINDOWS\mssecsvc.exe	rundll32.exe
File created	C:\WINDOWS\tasksche.exe	mssecsvc.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

mssecsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-85-34-25-b8-aa\WpadDecisionTime = 5096839cfba8da01	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-85-34-25-b8-aa\WpadDecision = "0"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A07C9476-AC17-43B9-84F9-BB4F24E05F94}	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A07C9476-AC17-43B9-84F9-BB4F24E05F94}\WpadDecisionReason = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A07C9476-AC17-43B9-84F9-BB4F24E05F94}\WpadDecisionTime = 5096839cfba8da01	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A07C9476-AC17-43B9-84F9-BB4F24E05F94}\WpadDecision = "0"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A07C9476-AC17-43B9-84F9-BB4F24E05F94}\2e-85-34-25-b8-aa	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	mssecsvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0093000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	mssecsvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{A07C9476-AC17-43B9-84F9-BB4F24E05F94}\WpadNetworkName = "Network 3"	mssecsvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-85-34-25-b8-aa	mssecsvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-85-34-25-b8-aa\WpadDecisionReason = "1"	mssecsvc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

rundll32.exerundll32.execmd.exe

description	pid	process	target process
PID 2476 wrote to memory of 2012	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2012	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2012	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2012	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2012	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2012	2476	rundll32.exe	rundll32.exe
PID 2476 wrote to memory of 2012	2476	rundll32.exe	rundll32.exe
PID 2012 wrote to memory of 2448	2012	rundll32.exe	mssecsvc.exe
PID 2012 wrote to memory of 2448	2012	rundll32.exe	mssecsvc.exe
PID 2012 wrote to memory of 2448	2012	rundll32.exe	mssecsvc.exe
PID 2012 wrote to memory of 2448	2012	rundll32.exe	mssecsvc.exe
PID 2996 wrote to memory of 1904	2996	cmd.exe	shutdown.exe
PID 2996 wrote to memory of 1904	2996	cmd.exe	shutdown.exe
PID 2996 wrote to memory of 1904	2996	cmd.exe	shutdown.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53606881d4f8b4934c5ade1947e88bc9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2476

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\53606881d4f8b4934c5ade1947e88bc9_JaffaCakes118.dll,#1
2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2012

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2448

C:\WINDOWS\tasksche.exe
C:\WINDOWS\tasksche.exe /i
4⤵
- Executes dropped EXE
PID:2756

C:\WINDOWS\mssecsvc.exe
C:\WINDOWS\mssecsvc.exe -m security
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2712

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\system32\shutdown.exe
shutdown
2⤵
PID:1904

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:616

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:3020

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\11360953-66f7-425a-954c-86649a8a77be.tmp
Filesize
242KB

MD5
541f52e24fe1ef9f8e12377a6ccae0c0

SHA1
189898bb2dcae7d5a6057bc2d98b8b450afaebb6

SHA256
81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82

SHA512
d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

Download Submit
C:\Users\Admin\AppData\Local\Temp\1b27ef96-07b8-4b7d-af67-9ed65f32bb27.tmp
Filesize
88KB

MD5
2cc86b681f2cd1d9f095584fd3153a61

SHA1
2a0ac7262fb88908a453bc125c5c3fc72b8d490e

SHA256
d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c

SHA512
14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986

Download Submit
C:\Users\Admin\AppData\Local\Temp\3319489160
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\53606881d4f8b4934c5ade1947e88bc9_JaffaCakes118.dll
Filesize
5.0MB

MD5
53606881d4f8b4934c5ade1947e88bc9

SHA1
5588e92d9be1ced63f3f9c6514a1a4a0ed90995e

SHA256
554f9a45ff13004de1e16fab4be1e467374f940a963cc9ce65d2906f0c54857a

SHA512
d431c39be859d8ce73c2e12a5cbf6d538540fdb9811b85cc65fde9bb2e3336ab3af5e80f6cf77c10a768e3f45cc8b699980f9a04bb909c3238be5d0ad853948e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00000.log
Filesize
4KB

MD5
dc451687fd587e9ea66df6f852575931

SHA1
9fc60d126f3a2292e18b8855c2abefcb1009d243

SHA256
520ed3a0308ea74b3f5d3d940cda2097b167fec3ac0ece430d2631bd289d954d

SHA512
b108294c1e8f0451d4a3990a008a3ae267f9243a51fe92d70192cffe62ef3ac61ba232940a45508895f8ac4641b15fb5a60ce566f25cb7c2db7a1ad818e107ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\ASPNETSetup_00001.log
Filesize
2KB

MD5
ed22c9957cb68d5bf7a7c9803ffc044e

SHA1
b798a43b1868d032bd73f86a54dc4a94c00fa11d

SHA256
156741c77b4f6a3012f651a42e50b895e141ecd8dd68cc8889757c79748de027

SHA512
c6384e7e3ba4ad797d7db668560e27d22ac0f4eb2644eb9647f0fdecaf683b5e837ead1a4ddbd34e5263a83d13710f55673681c8618fbfe94ff67564665c5a28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Admin.bmp
Filesize
48KB

MD5
343fa15c150a516b20cc9f787cfd530e

SHA1
369e8ac39d762e531d961c58b8c5dc84d19ba989

SHA256
d632e9dbacdcd8f6b86ba011ed6b23f961d104869654caa764216ea57a916524

SHA512
7726bd196cfee176f3d2002e30d353f991ffeafda90bac23d0b44c84c104aa263b0c78f390dd85833635667a3ca3863d2e8cd806dad5751f7984b2d34cafdc57

Download Submit
C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
Filesize
4KB

MD5
612a650d1c773ee52d62546e66ff5918

SHA1
a7479722bea44f8719b651ba69aa337d60da4290

SHA256
9e0774deea09130ce23833cc3f0118e8dd06750e3570a230b199c87cdf354c00

SHA512
5882a9d5340d0197c660d0774f22a82f03a0fc73d14476c47d3ab86dfea8f80850bfb8af7a9433b120f4728da4889083086666145b3e2390966e6816ad981483

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240508_141741285-MSI_netfx_Full_x64.msi.txt
Filesize
12.6MB

MD5
350bffad502f987f3fcb9d8388355e57

SHA1
316e95fdb50c4afffc728ea575f593410c0cb1dc

SHA256
33fce0d02c03820899ef110f95114870c45a5294ce6b3a0562f1d13c1e932195

SHA512
718e3871f80d9562dddd813fb6e4faa9b9fe497382694b72fdb4ee2781c965926d999e59fbcfc9c6602d589389c42aa30a2ac38b49bf0eb6080ca6f1d3ed6ba7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240508_141741285.html
Filesize
1.1MB

MD5
015f43c472f87d3133dbdb4c69613e8c

SHA1
e6c616ef8d2fb22e4d278aa4a7f21425623b41a2

SHA256
e0ca9444eb49c75227f11781a771f607f3983db22fe854b03f42c03708eeb1be

SHA512
b0877c187846cb984442564b6857db540a222a1e78359fe858bdc0c2acb066016295950c3de8df2d245d61f97a2ef786e5f5993ef4aa929c67101304b9e939aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\RGI2637.tmp
Filesize
10KB

MD5
dbef78447120e830587017c581f994f1

SHA1
ea5214b9503e9a3b5335053b9f2e85c1bd26f3ce

SHA256
a380116d80066949811b29c5b53c20488c1ca6b05a955c1698aff58fc18ebf94

SHA512
eda079a1c4e25d18099accf11860b7c78c9c303c855d87ddfd1750a41e47571db6acf929921a20be693a18d948799279c3f7be47574a2004810021271d735b3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RGI2637.tmp-tmp
Filesize
8KB

MD5
4aae089d3731c3f9dca27587e61cc4a2

SHA1
97b570c80cce9d68fbdd728f8524d92bce4a5c35

SHA256
ed8f2f1786d5c57aee9c8228286f41b1665f46b88b882557675350d5108b438c

SHA512
6ec755dc7f6531bf0ecec25f8fbf5f712ccf46f93b954f8acf522b33b4bd13f3781e73f1122a81bd5165c507b0a58222a3cafe6fbd25f5d606b4414a9a4009fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\SetupExe(202405081421272F0).log
Filesize
203KB

MD5
d5d75b381456a45d0a0b6564315fa3be

SHA1
f7d92e0778c26bbdc093c55b9fd6301a68d8e0f8

SHA256
43bdc442584801a429bfa57226147ab48d119c199469af1b560c7d1492b61628

SHA512
af8f7b692ed6aa3852574e94a42131c3b0c1d20957665a4fc0115a97e6798aeda413e3ea3fd503294eb4e79955cb9a30597e487594feb39a58ccf2cfde20a981

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
Filesize
4KB

MD5
24ba95cdb9370f61638fd3d5eae535df

SHA1
02efbe1a44d8f7717323cd125aff11e6764d12d9

SHA256
4f67db9060fc5d7440f5a8e810026f3c713a5c5d49facdd294dcdba5f69d0b7e

SHA512
e5d1378de53b1327bb6f24f94db2a9b9be8d4e08e26c1a74585fbca89696c73ce7a714e22d9317b901978ab3570af0a5893c5e997892100e31eb4e2827e5229e

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
Filesize
1KB

MD5
31063c1e160483cd037ddd01f0e3de20

SHA1
8471c00a4dafbc8a9a593713133ecd49cdec73d4

SHA256
46a7bf1905ba07083ad50cc0ac44e3b9e1a54b1304a05dd49402d76a390e7dd4

SHA512
5f85466db320694cd3d6c6cba7f456c5b072f958121de76d2c282e815c7e48f55c12b413214dc4d668247998d895f31887958b8763861486cd58e08d162017fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.txt
Filesize
2KB

MD5
22d35d26d98476e26bc94510ae286849

SHA1
e7edb57e01d336b5c4a135b381e6f493d32c6731

SHA256
ef54c94e698f2e57178a73d1d5c30e58f3f6dee8515402ea6060e316985a6fca

SHA512
eb7785655e1fdd570373d20f00f68cbaff08a761d5dce8eb07d0e7f7496098237ad7d288224d3bf10e3b3f348d40c6d14ff601025baf2a4da0c30962274c6665

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI394D.txt
Filesize
423KB

MD5
7f5cfba61e1c0ec776eebfd526167a51

SHA1
5b5eb85d5035cf19053394eeffbbeef4a670d927

SHA256
caaee56a094f9d844b828f8fe83b970ddc1f628e829599ad3cfd3eab742bc54d

SHA512
40486086393d481b465d8f279f5c4248b67f62b9fb8898b9fa1991cc334861a1be02e66da492c7fb6f5725381ab0d7f6aacd4b5f69dcfea494a802652871fd5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI3988.txt
Filesize
413KB

MD5
f6389a2228868fa76a3472c780a0ec78

SHA1
cb8046fc61531756ff34ddfbd3d1915c6d3232a1

SHA256
37b4854a4d59146d8af22f2a882c733d7c484d7628f7e8572b698e622f0fee19

SHA512
aaec887e5ae77699a74806efc9218e551c2ee7c7e47e8b74c33cbb8f2bb3c5a65dfedf38a52875cbdcffaab39c2f15cea5d2347149efffb72fccadbe71888473

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI394D.txt
Filesize
11KB

MD5
f15dc049aff480b4b2583bd941580ef3

SHA1
93a31828c2c05501b9a2f65bf307a0b63b608dea

SHA256
fb2c20ddc92996f38c678069dfb0f3d1ce7ed7ce15de2bbe9f3d24221a48c6b4

SHA512
00161a4146e1133e104420ca560a27ab1cd172276afe6dbea5efcbc0e6f7d60b0e5f5f4763ef3e6004b9fb33714bce874fb877d03b0971d55570ec5f4028bb77

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI3988.txt
Filesize
11KB

MD5
4a8ae58ec369fc043ecea2a41fde493f

SHA1
d6aa175d0f23bf1359b76de138f1b1f013d63154

SHA256
b5f4b93c524385ee8c2a634e969cbaa056a3df241a248321a95e480c6c1e7cfd

SHA512
d433ae368f2da8043285d0ecf1de224f79ef82416f86a56194bcd9c1e5c927eadafc1f2b5d664688909070a72333bdcb38631882e3f3ded9d2d229edff15b3d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20240508_141754_092.txt
Filesize
7KB

MD5
9b8c8a70bc116211852722cb42da0f15

SHA1
76d42917f57946eabd9850b4474557a868282630

SHA256
045fa3bdddc25419e8b94e5295cb825afa2c1fc497a7c62888133da5ffaab1fe

SHA512
465480adada2a4413f513d29d6317f8b765b8f58a24a326178c9ff2867733e5c34b5fce35b6b9c3fb2f71e6a9688298d088f1463b0176df9d0c8908939daea2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_wcf_CA_smci_20240508_141754_529.txt
Filesize
2KB

MD5
6df70b512b25e16d3a6b8b7972ad7a0a

SHA1
ff7feaec32d6661a489433d3b5a6889a65b1726d

SHA256
75970b816a006219712b07b9f525c4037fd7a807837583204784393bf83180ba

SHA512
1288314c830afc5f21abf3f9083c6ef8b7948c5719f03eb8bf852088ec2d5fd0e395eb7f3ec9a11135495fe5f5fbe5baa98622d956b6d25e1b7d9927c66f9aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\java_install.log
Filesize
170KB

MD5
61698f2ba07bda2ba323140f20b28e28

SHA1
d3e46602b6e042abdfb6a8630ccaff23801cd104

SHA256
51c06f89c259219fd364b1a36991964e772e968873496a4d61532d488b2cb8c0

SHA512
eb7f3dc17e49d2c2191fd6eb235e22ef3aa63157f90da42af3e6653e174e129e663b9c1eac8798d770a99ecdad4230754f07c84a96a73d85e6c8ef14aeb1cfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\java_install_reg.log
Filesize
4KB

MD5
36cf8d512a14fd2c5263e06775f2da47

SHA1
3e8ae2e7855ac773837272177b985f1705f65667

SHA256
c3d0d9bf10e08fc22138cb4fd1d0fdf59f37cd2e12e3ff779ece43259f861cc9

SHA512
e61afb7cf48065a5ad087dcd9ae7ae2c46552cb68c1bd1bd8f9df51b8f0eb040e6e69423d45b09166d16959e7bd1e247d7dd02552da8ec40d9bc805883e58725

Download Submit
C:\Users\Admin\AppData\Local\Temp\jawshtml.html
Filesize
13B

MD5
b2a4bc176e9f29b0c439ef9a53a62a1a

SHA1
1ae520cbbf7e14af867232784194366b3d1c3f34

SHA256
7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73

SHA512
e04b85d8d45d43479abbbe34f57265b64d1d325753ec3d2ecadb5f83fa5822b1d999b39571801ca39fa32e4a0a7caab073ccd003007e5b86dac7b1c892a5de3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log
Filesize
347B

MD5
0093cbd773d954f24ed2cf17d3e43f3f

SHA1
f48e2d8ad1d91f947b5af3950057e4da81ca675d

SHA256
6a57e660c379df922823344d7eeebbac7ed7f95f5809191ab2642c6693688222

SHA512
3491463c6b68e2d1984297249c01181ffa4aceecce036e92be5fb1f1b581ff1c481d6842112dbbd2e4c6e18ca783989dc3d3aba92af2bdcef9a884011c93eea1

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup-20240508-142611-0.log
Filesize
33KB

MD5
f79d700e72827b75ea6f91e4a24993ae

SHA1
4860cebf75086ae4d756957cbc3d85435dd51c3c

SHA256
576c56d05f5b266716cdc2a9d0575ac5d1db20dbca2a886805bdcfcd9e1d8781

SHA512
cd035ff55c4d3de94e71d872c077d7bb8f5c42921df3e2805d6f6ab10770894e2675069c5c2a643013f7f289b21bc4ec5f2ea287dd0da081f44038642ceeb885

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup-20240508-142747-0.log
Filesize
34KB

MD5
7244ebc56c45002ee1cb46e2e79e3555

SHA1
ae9e99e252874c142c8ade2992fc5cd2bfa8df35

SHA256
578fa474da9e8e8145bb675f7875969c3216c048527919f23f15de54b1d43ac9

SHA512
9f9575cb74f5e4a23ed243db6f41ff39a97f487048f1dc47b5e2756f4d3af6f4908650365794643b059551348c4b83efcc100dc2e7f66e7f3387021f52d46393

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup-20240508-142920-0.log
Filesize
44KB

MD5
b7a95aea4c3ab30bd7148b11c43b6878

SHA1
186bd2746a4a43a7e8d5fc32d941afa779512d69

SHA256
0608d621031ad73987dbff1ee651f2e8287a6d45969287bd09f123737f01cfb1

SHA512
89e84980ef24f8275b64734c11a730ea57dc305034a208501c58d1a671c22ea1146d994ae9bff4b0949fbeb5a703d2b64d8b6f817ed2c295de93bb13806f6234

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup-20240508-143101-0.log
Filesize
35KB

MD5
88d35786acf547ca62f267414901b45c

SHA1
07ca90ef463e4436b9da4fc7484580815e8389b5

SHA256
1a3c9e7a2cc2c1e24c1c09c2c070c18b4484817a1b594a45b3e61a2f4f2f02af

SHA512
5a6040ed78a4afbaa2e7ff2b64bd0ee30946dff0fcd4ef5c8d5959d702f89f92dc69600d4f825f15ef9dbe8486a15ae9483c56b1f6412d79bc6a12c6a040868c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup-20240508-143242-0.log
Filesize
36KB

MD5
b0b3164c6fa1f485268dcf2d4ed3659e

SHA1
f828aa61ed7f72e2b1fa9e5e13cc477821e2f69d

SHA256
576c28cfc5b2396251bc03a0e3b0feb9d06a74a2c055a6672db5ab38fe606808

SHA512
937f357d3e0c77b31d78c7246ab9744fa205c77124b0793610907b838d0b8ac3d67ab74e9793871f7ec86c81d151f0d10017144f5cb4ca48cb0652ea9dd193b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\ose00000.exe
Filesize
145KB

MD5
9d10f99a6712e28f8acd5641e3a7ea6b

SHA1
835e982347db919a681ba12f3891f62152e50f0d

SHA256
70964a0ed9011ea94044e15fa77edd9cf535cc79ed8e03a3721ff007e69595cc

SHA512
2141ee5c07aa3e038360013e3f40969e248bed05022d161b992df61f21934c5574ed9d3094ffd5245f5afd84815b24f80bda30055cf4d374f9c6254e842f6bd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Filesize
843B

MD5
0f5e891affc8f608d50ca5039846fa92

SHA1
fa330367341c5054109fb25039c4beba1684385d

SHA256
6c9f0d1ef7db1f541a5b9c46cee5c421cd2b124bffedb15b4df25bff60f7ee7f

SHA512
862a7c40db891733bd03daa81b155f079d313a8d07a614a34071b6db4a7dce3d7d199b25ee52d2e5cb52c2d7d7a7c3d0b59f482ba94c441ca4f777c26587d7ac

Download Submit
C:\Windows\mssecsvc.exe
Filesize
3.6MB

MD5
73d70a80e0c6e1e48ea11b3d8a8a1751

SHA1
324859b5d9375d54f04f71ca57f6b40da225698b

SHA256
6c625b9cc9f1b30cfd2353788bb6c602f06f5367335e7ca08ddbd3a8a9367cd8

SHA512
74836df0c9c76fdafe7bd88064d36d3755db1362e20e54f905597a7886ac6d552659aadf2bb5358913ce08e5d983f46b32f442169f00746f2d29160f59e667f1

Download Submit
C:\Windows\tasksche.exe
Filesize
3.4MB

MD5
c78dc18cb700bf44bda65f0c034d5ba0

SHA1
f31459a361538232d6bb782242288cb731641acf

SHA256
7e5dfaf660b26409f5359a6ca7b7ffe682c6d9c9b5a74fa889974291e933ae0b

SHA512
e1e5c95bc66c13949b871c06bf40cc82793b9a4dd570212f336101742c7994aa5cc559e33fea1425a395207d0d82df6bc155db773a178c5b3afb94df54ad79d4

Download Submit
C:\vcredist2010_x64.log-MSI_vc_red.msi.txt
Filesize
363KB

MD5
7d7c220eeb7a4e516285b679121e9e80

SHA1
2ffa1d3cbaa8b4a70e07593d6f4b88158ccf3f32

SHA256
d3724169e973b7a7e95f00e03b54ee5aee23f7eaf018ddaf924cf37fbdffd574

SHA512
8cedbf015e8a2f75f714a7c7576fb7bd25564459947f3eb74efa29f3b22cbc51983dab5fe0abbb4e72f2ce1930a9e5163cb30b2f3d18f91dda25bdc552d51e6a

Download Submit
C:\vcredist2010_x64.log.html
Filesize
86KB

MD5
5fa61da0f15da8a26fa822888546bbe5

SHA1
4a48f8045d17239b17112e125e747f671f169ef6

SHA256
c07a4feda31f44a6a87a0c77dfd90ef6654e7bcd78e071c92d429e3df42dfe52

SHA512
3574503602d9845416f25cf025a431419973a08c6db964af7194718b47808cc585ef20d2bff61d3e3fa1c461523385b6eb914222d3315efd17abbec4bef0253b

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt
Filesize
378KB

MD5
9d2cabd1c764f164e02d30c950208ec8

SHA1
c6b376ada88de2a9305f10081ff7e4afc15633a2

SHA256
cbbd8f71195097ac1204f697f8bcf6ee18730a61b8d9fc9ad821124ec8cc8ddd

SHA512
5fd96d6a9489394336f74acfa039df1df678d1e3aeed4d685a377ab91bbda2c01111bb1ec87f01c788bb7a3fa509aecab8c32fa9497b5403a7458c2d36411f94

Download Submit
C:\vcredist2010_x86.log.html
Filesize
80KB

MD5
9257492826dc4334b5ef7947ac5be979

SHA1
22b27577025be070669f614bf0a1a54a40149371

SHA256
645f7197fb6c302693c65e7e38e3730f82c5aa139592e26ef6e2c2271499d747

SHA512
3a22e6b84bef0418821820c5ecec2f104b5f5fa4a19021b415a2eabcdf1ccbc86b783a65fdf8c186b9e74159111f1d9a0f36a18e7da1e0f8082c853c5b0ba7c5

Download Submit
C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log
Filesize
165KB

MD5
fb00252d48f624c8c6a35619eac43e33

SHA1
e6d3405a4b6bdbfb6aa34f7e6039b2f929532df7

SHA256
0a5d593ef1fcb65ebae96a5476ab0da20411ec2f95c9cb8dec03e806053e3f6e

SHA512
af579e9903afc4090f9571d5c87d07cf87fb62ba77370fb3655e922bfc2f47b1ee96c201a575dfa196ab042f70d4528cf3e4dad04aedb58195648e2c3a68d98e

Download Submit
C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log
Filesize
193KB

MD5
04ab1e5e6135992887c4bed839188c57

SHA1
10e684a0c156de97814a72b3eba284506f29351f

SHA256
24c581ad067321aadd9ac15d53e82f7586cff308e4d6fd5a2a3317752ba93b07

SHA512
7b38b53884c1ee14fd033b9c81c4a25d80b1090cfacb5da8f84b18f789be5ee1f5506c06a9a3cbd947d26867ec4caf63ed94b63cf69228a8ee48f59ee64a7206

Download Submit
C:\vcredist2012_x86.log
Filesize
8KB

MD5
9a4051543182e82ca4bd955c4b78ce4e

SHA1
72d220ebbc8acc5ef444b461e7e8fc8fd81e97a5

SHA256
1fb709c36c7c9dd2afd774d6efcb70fee755e48ae5613b3343fe37b4fac361f4

SHA512
82fd0a5570a52978d2a27c3972ebf8e3f3468bc29a5af6092422761d5d2a63125f06436f6f9ba5e5b605b3ee48b57bc28e5636bd0413877dd5817fbea18fc6cb

Download Submit
C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log
Filesize
168KB

MD5
6131a7eae851e08f0f31c92057a832aa

SHA1
55f90f1fbe28c6af83b035c11da560399949e74f

SHA256
1fd48550c43269b668e9167b3c16f49559a72bc03ffb06450853c33335b0b975

SHA512
ae8dd65ea292fd49eab5b5574cc1090d5b290b640151fa4a62a87c2af7898ff9eaf37770c2f5c36bde911d0bc0aab001deeb651f4be21ef1b1bafec23534df73

Download Submit
C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log
Filesize
206KB

MD5
76c19c30f59f5ef3b54030327847f9e8

SHA1
7db0d967f6eefc81050ad214186981e350b0dfe9

SHA256
79a7ab416821e0f34e3c96b6521db0512b2b9b5b5819744e0519afb0993075fe

SHA512
5721332d668c57d5d077f54d30f4c38d4c799b0c0ecd93165f71e39aafb07f76f2b8fbffa8bcefac9f687560ff41f0e9d6c4e5cf2ff7bf504c8bb713af927a4a

Download Submit
C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log
Filesize
167KB

MD5
0a412958efa38891ff5367613fc23ef8

SHA1
b8d976af21548b40b85d23f01360720be701c765

SHA256
f0e4d55f9e08ab7116b0362d3b74281c25c2fca6e2bd6146b0e3bc84e08aa9b2

SHA512
37894381cb48fb4d3588add8fc8a4350b9b7eb345792d199500d6616f299a487d2d2e55dc6ad9aba3e8f9e77f7319b7d665ee4c08ed3085dc0529a3e75b40eea

Download Submit
C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log
Filesize
188KB

MD5
6d6d2860891bc4e52cbbbe500a471198

SHA1
8eb32f48728bd2f0e51b5904dc34455e8320886e

SHA256
2b9c71984ab8c268450da407d84b3dbda2938977c754d2a04653c6b817b1bd18

SHA512
702423605ed67215425cd882c7582f476b19c8846ccc1a5b5a36e1aa29b45c54608a6ea2f2e5af54c3ac7e65858d841281e0eb42522b75bb2a528c3b734c950b

Download Submit
C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log
Filesize
168KB

MD5
5f78e976c3d82ba322960fa06e0f7d74

SHA1
8da18014853e8775004a3925058fa153f7602f84

SHA256
7b4bd7c39996a4aab68f78fbff55c9174d1ad03f0823d15d7fce79e3f172acea

SHA512
4f49940332c6025dd5e5d18d992d3cead83fa5d103cc87471d5e11f65ab4af2b970cab718bc9527cd1f7d1af49367ebc62c614d5019b1463d846fd6fd456ee2b

Download Submit
C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log
Filesize
196KB

MD5
1db97c9d8398b4e4825a42dab88f19e4

SHA1
b9ca518fc441025c9da7844ecd189ce0e3d973c8

SHA256
036fee51c27c70e530b0a2333690470f3f3ee61f2188735313cd4693e09f010e

SHA512
4576e99f1e2b58cbe303786dbc81071fb23def0cd9da444bf6150199ab8e822ee66a8e25572e27348d776c5abac80de4615ce2bcc27c5927bdc4e3b8d5af16b0

Download Submit
C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log
Filesize
120KB

MD5
80e028bfa22407f1b074ab67397d98a9

SHA1
72111529194eba385b30692e15ad0b5dde33cabc

SHA256
bc349a0419748af9be3b427aaac4effdf9d97fd29b8ec776867d9ebc8dd0cfa3

SHA512
a74bd341eed7726f207a42f28c49c978f977f1b3fe6cb9628f2e7fb0630c46217f576b2a0145ca4d5f5306d21b5e4a343fcf8106721105fd6ea85a24fac4326e

Download Submit
C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log
Filesize
127KB

MD5
5cf710a00aba4a8b5462a557afbeee60

SHA1
d16d25c430aae41f6e476f6bf2275c3e3484c34f

SHA256
dd985adbb53f4e764b56c36fea35ebed78b6b2c3066f5122520eb5c3378d9b49

SHA512
943a14a912bd8bf0896305f9a0c77f2854b13e411e992542e2487c1a8330ecf6085888e2391ff62afa530a3a392299881ea10bb1e61728d9c9b9a23253892b09

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads